When Family DNA Becomes Public Policy

A request for a paternity test can sound like a private disagreement: one parent wants certainty, while the other hears an accusation. But the argument points to a wider public question. DNA is not only a fact about one person. It can reveal information about parents, children, siblings, and relatives who never agreed to provide a sample. As home testing and genetic databases expand, family trust is becoming part of a debate about privacy, consumer protection, and public power.

The issue is not whether every test is justified or whether every request is insulting. It is how people and institutions should handle information that is intensely personal, shared across generations, and difficult to make anonymous once it leaves the home.

A family question with consequences beyond the family

In a household with a new baby, a parent may describe a DNA test as reassurance. Another parent may experience the same request as a claim that their fidelity is in doubt. Both reactions can be real. A test can answer a biological question, but it cannot automatically repair the relationship in which that question arose.

There is also a third person in the room: the child. A child cannot meaningfully negotiate the long-term consequences of a genetic record created in infancy. A result may settle parentage, but it can also disclose unexpected family connections or medical information later in life. That does not make testing inherently wrong. It does mean that “just checking” is not a consequence-free act.

The National Human Genome Research Institute explains why genomic privacy is unusually difficult: except for identical twins, a person’s DNA sequence is unique, and a sample cannot be made truly anonymous. Even data described as de-identified may sometimes be connected back to a person when combined with genealogy databases and public records. [1]

That is the central public-interest insight. A DNA decision made by one adult can affect people who did not make that decision.

What a consumer test can and cannot promise

DNA testing is often presented as a simple exchange: provide a sample, receive an answer. In practice, the sample may generate multiple kinds of information, and the company’s policies determine what happens next. Data may be stored, used for research, shared with service providers, transferred during a corporate sale, or retained after a customer believes an account has been deleted.

The Federal Trade Commission’s 2023 case against 1Health.io, formerly Vitagene, illustrates why promises deserve scrutiny. The agency alleged that the company left genetic and health information exposed, misled consumers about deletion, and changed its privacy policy retroactively without adequate notice or consent. The proposed settlement required stronger security, affirmative express consent for certain sharing, and instructions to contract laboratories to destroy retained samples after 180 days. [2] The case was an allegation and enforcement action, not proof that every testing company behaves the same way. It does show that a privacy policy is not a substitute for oversight.

Consumers also face an information imbalance. A company can revise terms, merge with another business, or enter bankruptcy. Customers may not know whether a deletion request removes raw data, derived reports, physical samples, backups, or information already shared with a third party. A person testing a child may not be able to predict how that child will feel about the decision years later.

The 23andMe sale changed the policy conversation

The 2025 bankruptcy and sale of 23andMe’s data made those concerns concrete for millions of customers. A peer-reviewed Science article by Natalie Ram and colleagues reported that more than 15 million people’s data were transferred to TTAM Research Institute after the company entered bankruptcy. The authors argued that existing U.S. law does not provide a comprehensive baseline of privacy rights for this kind of consumer genetic data, and that the Health Insurance Portability and Accountability Act generally does not cover direct-to-consumer testing companies. [3]

The episode produced competing interpretations. One view is that a buyer with a research mission and a similar privacy policy can preserve valuable scientific work and avoid a worse outcome. Another is that a person who submitted DNA for one company’s purposes should not have to rely on a bankruptcy court to decide whether a new owner is sufficiently similar. Both concerns matter: research can benefit the public, but consent can lose meaning when control changes hands.

The authors note that proposed federal measures, including deletion rights and restrictions on selling genetic data during bankruptcy, would be useful but incomplete. A deletion right can place the burden on consumers, and it may be difficult to exercise for children, deceased people, or accounts created under inaccurate names. State laws add protections in some places, but coverage is uneven. [3]

Why public safety complicates the debate

Genetic data can serve public purposes as well as private ones. The Department of Justice policy on forensic genetic genealogy permits tightly limited investigative use in qualifying cases, including certain unsolved violent crimes and unidentified human remains, after conventional searches fail and other criteria are met. The policy says a genetic association is an investigative lead, not proof: no one should be arrested solely because of such an association, and a direct DNA comparison is required for confirmation. [4]

Those safeguards address one danger—overreliance on a probabilistic family connection—but they do not erase the broader consent question. A relative who uploads a profile to a genealogy service may make it easier for investigators to identify another relative who never uploaded anything. Supporters see a tool that can identify victims and solve serious crimes. Critics worry that family networks become a kind of involuntary database and that rules may expand over time.

This is not a choice between science and privacy. It is a design problem. Public institutions need clear limits, transparent reporting, retention rules, independent review, and meaningful notice. Companies need security that matches the sensitivity of the data and policies that do not quietly change the deal after collection.

What a fairer framework would ask

A credible policy should start with several questions. Was the person providing the sample told, in plain language, what could happen to it? Is consent specific, revocable, and separate from a general terms-of-service agreement? Can a customer delete raw data and physical samples, and can they verify what deletion means? Are children’s interests represented rather than treated as an extension of a parent’s account? What happens after a merger, sale, or bankruptcy?

Families also need a less theatrical conversation. A paternity question should not be disguised as a joke, announced as a verdict, or treated as proof of wrongdoing before a result exists. The person requesting a test can explain the uncertainty without assigning blame. The person hearing the request can describe its emotional and relational cost without being told that privacy concerns are irrational. If the disagreement cannot be handled respectfully, outside support may help—but no test can substitute for honesty about why it is being requested.

The original family dilemma remains human and ordinary: people want certainty, recognition, and trust. The policy lesson is larger. DNA is both personal and relational. Until law and technology fully reflect that fact, the safest public approach is to treat genetic information as belonging to a family network, not merely to the person who clicked “order.”

References

1. National Human Genome Research Institute, “Privacy in Genomics” (accessed October 8, 2026): https://www.genome.gov/about-genomics/policy-issues/Privacy

2. Federal Trade Commission, “FTC Says Genetic Testing Company 1Health Failed to Protect Privacy and Security of DNA Data…” (June 16, 2023): https://www.ftc.gov/news-events/news/press-releases/2023/06/ftc-says-genetic-testing-company-1health-failed-protect-privacy-security-dna-data-unfairly-changed

3. Natalie Ram et al., “The precarious future of consumer genetic privacy,” Science 389, no. 6765 (September 11, 2025), available via PubMed Central: https://pmc.ncbi.nlm.nih.gov/articles/PMC12810892/

4. U.S. Department of Justice, “Forensic Genetic Genealogical DNA Analysis and Searching” (interim policy, approved September 2, 2019; effective November 1, 2019; page updated February 5, 2025): https://www.justice.gov/olp/page/file/1204386/dl